IT Risk & Resilience Lead

Privy; Jakarta Pusat; On-site; IDR 600,000,000 - 1,000,000,000; Full time

Job summary

Privy is seeking an experienced IT Risk Leader to own risk methodologies, maintain an integrated risk register, and translate board-approved risk appetite into operating tolerances. You will drive BIA, TPRA, and risk reporting to the C-suite, across IT, operations, third-party, and privacy risks.

The role requires a 5–10 year background in IT risk, multiple frameworks (ISO 27001/22301, privacy standards), strong analytical skills, cross-functional collaboration, and a track record of

Qualifications

• Bachelor's degree required in IT, information systems, CS, business administration, risk management or related field.
• Certifications in risk management are preferred (CRISC, CISM, CGEIT, ISO 22301 Lead Implementer/Auditor, COSO ERM).
• 5-10 years of experience in IT risk management, enterprise risk management or GRC in regulated industries.

Responsibilities

• Own IT risk methodology design, documentation, and maintenance.
• Maintain the integrated risk register across IT, operational, third-party and privacy risk.
• Translate board-approved risk appetite into operational tolerances and financial thresholds.
• Lead the Business Impact Analysis process end-to-end (BIA).
• Manage the Third-Party Risk Assessment (TPRA) programme and annual reassessments.
• Translate cyber risk inputs into risk register entries for executive reporting.
• Expand risk coverage to operational, strategic and supply chain risk.

Skills

Analytical thinking

Systems thinking

Decision making

Communication skills

Cross-functional collaboration

Risk management

Education

Bachelor's degree in IT / CS / Information Systems

Job description

Privy is seeking an experienced IT Risk Leader to own risk methodologies, maintain an integrated risk register, and translate board-approved risk appetite into operating tolerances. You will drive BIA, TPRA, and risk reporting to the C-suite, across IT, operations, third-party, and privacy risks.

The role requires a 5–10 year background in IT risk, multiple frameworks (ISO 27001/22301, privacy standards), strong analytical skills, cross-functional collaboration, and a track record of